Fault monitoring system

ABSTRACT

A fault monitoring system comprises a fault detection mechanism to determine the status of a parameter to be monitored. An integrator counts in one direction when a fault in the measurement system is detected and counts in an opposite direction in the absence of fault detection. A threshold detector generates a hard fault indication when the integrator count reaches a threshold value, and an integrator count monitor generates information indicative of the state of the integrator count when below the threshold value thereby providing an indication of the progression of the fault.

[0001] This invention relates to a fault monitoring system for providingan indication of the presence of faults detected in, for example, asystem for monitoring operating parameters within an aircraft.

[0002] In a known fault monitoring system, in order to discriminatebetween intermittent and persistent or “hard” faults, an operatingparameter is checked for the presence of a fault during successivesampling periods which may be, for example, at one second intervals. Anintegrator is provided which counts or ramps upwards towards a faultconfirmation threshold every time a fault is sensed and counts or rampsdownwards between sampling periods in which no fault is sensed. Theintegrator has an integration ratio which is such that for every upwardcount consequent on a fault detection, there are N fault free samplingperiods for an equivalent downward count. For example, if a system has afault confirmation threshold of 30, a sample rate of one second and anintegration ratio of 1:50, a fault will be confirmed as a hard faultafter 30 samples, i.e. 30 seconds. That is to say, the hard fault isconfirmed once the integrator reaches a preset count or threshold, inthis case 30. The system engineer can then investigate the fault in theknowledge that the fault has been declared “hard” and should thereforebe reproducible/ visible during fault isolation. Clearly, the fastestdescent possible from the maximum count of 30 to zero in the case wheresuccessive samples are fault-free following confirmation of a “hard”fault, will take 30×50 seconds.

[0003] If the fault is intermittent, in which some sampled periods willindicate the presence of a fault while others will not, the integratorwill count up and down according to the ratio of fault to non-faultsampling periods having regard to the integration ratio. Hence, anintermittent fault with a ratio of greater than one fault in 50 sampleswill eventually be confirmed as a hard fault. Depending on the degree ofintermittency, the integrator may reach and move away from the presetcount or threshold periodically. The system is therefore capable ofregistering such events as recurrent intermittent faults. Whether itdoes so, or registers them as confirmed hard faults depends on whetherthe fault is steady or periodically random. For example, in the casewhere the degree of intermittency is low, but not so low relative to theintegration ratio that the integrator never reaches the preset count,the preset count threshold may only be reached after a long period oftime. When reached, the system will indicate the presence of a confirmedhard fault even though the fault is essentially a very intermittent one.For an intermittent fault occurring less frequently than the integratorratio, the integrator will never reach the preset count and no hardfault or intermittent fault will be confirmed by the system, ensuringthat those faults that have no effect on the functionality are ignored.

[0004] Currently, the fault detection system may determine whether afault is intermittent or persistent (hard) by counting the number oftimes that the integration count reaches a threshold value. If a countreaches a threshold only once then it is recorded as a hard fault and isflagged as such by the detection system. If the count reaches thethreshold more than once then the fault is flagged as intermittent. Sucha system has the disadvantage that the type of intermittency is notrecorded. Also intermittent faults which take a considerable time tointegrate to the threshold value may never reach the threshold a secondtime in order to be classified as intermittent and are therefore flaggedby the system as hard. If the fault is classified as hard, the systemengineer will expect the fault to be visible during fault isolation andas a consequence may reject the wrong component if unable to confirm acontinuity fault. The problem is particularly seen in the case ofthermocouple temperature sensors. These devices generate signals of theorder of only a few mV and are therefore particularly prone tointermittent connection problems. With the increased functionality andcomplexity of modern electronic controllers comes an increase in thenumber of nuisance messages generated by low intermittency faults. Thesefaults often have no system effect but result in the rejection of theelectronic controller due to poor troubleshooting.

[0005] One solution to this could be to ‘mask’ the problem by increasingthe thresholds at which an intermittent fault is registered as ‘hard’.In the integrator system described previously, this could be done byincreasing the integrator threshold from 30 to, say, 40. Any change tothe fault integration system must be made in the knowledge that thesystem is tolerant to the fault for the period in which the faultcondition is active prior to detection. This is often a very difficultanalysis to complete.

[0006] It is an aim of the present invention to provide a faultmonitoring system that can provide the systems engineer with a morerobust system for determining and distinguishing between intermittentand hard faults. In particular, it is an aim of the present invention toprovide the engineer with information about the nature of theintermittent fault which will permit him to make a more informeddecision as to what, if any, action is required in response thereto. Itis also an aim of the present invention to make this informationavailable to the systems engineer prior to fault annunciation by thecontrol system. The engineer will therefore have a basis for monitoringthe ‘general health’ of the system being monitored on an ongoingreal-time basis.

[0007] According to the present invention, there is provided a faultmonitoring system comprising a fault detection mechanism to determinethe status of a parameter to be monitored, an integrator for counting inone direction when a fault in the measurement system is detected and forcounting in an opposite direction in the absence of fault detection, athreshold detector for generating a hard fault indication when theintegrator count reaches a threshold value, and an integrator countmonitor for generating information indicative of the state of theintegrator count when below the threshold value thereby to provide anindication of the progression of the fault.

[0008] The counting in the one direction may be at a rate equal to orhigher than the rate of counting in the opposite direction.

[0009] In embodiments of the present invention, it is possible tomonitor the progress of the sensed faults prior to the generation of ahard or confirmed fault message. Consequently, embodiments of theinvention have the advantage that they provide an indication of thestate of health of the system being monitored. Embodiments provide forthe monitoring of trends in the fault counts of intermittent faultsenabling prediction of specific failure conditions. More particularly,by correlating the progression of the sensed faults with systemoperating parameters, it is possible to relate the sensed fault topossible causes. This enables provision of a fault diagnosticcapability. For example, if the fault occurs only when vibration levelsare high, which may be the case during take off of an aircraft, thefault indication could be indicative of an impending connector failure.Steps may be taken to remedy the fault before actual failure of thecomponent. Other fault indications may arise which indicate conditionsnot likely to result in a degrading performance or system failure inwhich case the system engineer, armed with more information, can decidewhether remedial action is appropriate.

[0010] In a preferred embodiment of the present invention, theintegrator count monitor generates an indication of the ratio betweenthe count in one direction and the count in the opposite direction forproviding the information as to the progression of the sensed faulttowards or away from a hard or intermittent fault condition. In thiscase, the ratio may be averaged over a predetermined period of time orfor the duration of a specified system operating condition. For example,if the ratio of the integrator count in the one direction to the countin the opposite direction is only high during specific operatingconditions of an aircraft, it is possible that the fault is indicativeof a failure mechanism made apparent due to high levels of vibration atthese times. The system may thus be provided with means for correlatingthe information generated by the integrator count monitor with systemoperating conditions and so provide fault status or diagnosticinformation in response to the correlation.

[0011] In an alternative embodiment to reduce the requirement for datatransfer to a health monitoring system, the integrator count monitor maygenerate further indication dependent on the integrator count relativeto a sub-threshold value, which is set below the nominal thresholdvalue. In this case, the information indicative of the state of theintegrator count may be any one of: the frequency with which theintegrator count exceeds the sub-threshold value; the total time thissub-threshold value is exceeded; the maximum continuous period theintegrator count exceeds the sub-threshold. As with the firstembodiment, the information indicative of the state of the integratormay be correlated with operating phases of the system and the system maybe operative to generate appropriate system health messages.

[0012] The invention will now be further described by way of examplewith reference to the accompanying drawings in which:

[0013]FIG. 1 is a flow chart with reference to which a prior art faultmonitoring system will be described;

[0014]FIG. 2a is a graph illustrating the integrator count for twodifferent fault scenarios in the prior art system of FIG. 1;

[0015]FIGS. 2b to 2 e show, for illustrative purposes, four differentfault scenarios according to a different integrator count regime fromthat of figure 2a;

[0016]FIG. 3 is a flow chart with reference to which a first embodimentof the invention will be described;

[0017]FIG. 4 is a flow chart with reference to which a second embodimentof the present invention will be described;

[0018]FIG. 5 is a graph showing the progression of integrator counts inthe embodiment of FIG. 4; and

[0019]FIG. 6 is a schematic diagram showing the system components of anembodiment of the present invention.

[0020] A prior art fault monitoring system comprises an integrator whichcounts upwardly towards a threshold value (see Z of FIG. 2a) each time afault is detected during a sampling period. The prior art faultmonitoring system is initialised with the integrator value at zero asindicated in step 1 of FIG. 1 and shown as point A in FIG. 2a. Thesystem reads at step 2 a signal received from a transducer providing ameasure of the input parameter being monitored. At step 3, the receivedsignal is validated using one or more fault detection methods. Rangechecks, cross-checks and model checks are often used in combination toensure high integrity fault detection. Step 4 determines whether thereceived signal is indicative of the existence of a fault. If a fault isidentified at step 4, a check is made at step 5 to see whether or notthe integrator count is greater than or equal to the threshold Z. If theintegrator count is greater than or equal to the threshold value Z, thenan affirmative indication Y restarts the signal check routine. In thisway, the fault count is prevented from exceeding the threshold. If theintegrator count is less than Z, the integrator count is upwardlyincremented at step 6 by a value X equivalent to the up-count of theintegrator. At step 7, the upwardly incremented count value is checkedagain whether it is greater than or equal to the threshold value Z. Anaffirmative result is confirmed as a hard fault at step 8 otherwise theincremented integrated count value is stored and the routine restartedto check the presence of a fault in the next sample. In the next sample,it is possible that step 4 determines the absence of a fault, in whichcase the system is operative at step 9 to check whether the currentindicator count value is greater than or equal to the down count valueY. If the integrator count value is currently not greater than or equalto the down count value Y, then in order to avoid a negative count, thesystem routine is restarted in readiness for the next signal sample. Onthe other hand, if at step 9 the current integrator count value isdetermined as being greater than or equal to the down count Y, then theintegrator count value is decremented by Y at step 10.

[0021]FIG. 2a illustrates two possible count profiles for the systemdescribed with reference to FIG. 1. In this system, the integrator hasan integration ratio of 1:50 and a threshold value Z of 30. If thesignal sampling is at the rate of one sample per second (see countprofile i of FIG. 2a), then the minimum time it takes the system toconfirm a fault is 30 seconds, that is to say the time for the count tomove from point A of FIG. 2a to point B. The integration ratio of 1:50means that there must be 50 no-fault samples to achieve an equivalentdownward count. In this case, the minimum time for the integrator toreturn from the threshold value B to zero at point C of FIG. 2a is 30×50(i.e. twenty five minutes). In this example, the transducer beingmonitored causes the integrator to meet the threshold value Z for asecond time at point D. The fault monitoring system recognises thereturn of the integrator count value to the threshold value Z as anintermittent fault. The system therefore indicates the fault profilerepresented by the count profile i as a recurrent hard fault.

[0022] An alternative fault scenario is indicated by the count profileii of FIG. 2a. In this case, the fault occurs for considerably shorterperiods, i.e. it is more intermittent, but the ratio between fault andnon-fault samples relative to the integrator ratio is such that over along period of time the threshold Z is reached as indicated at point Eof FIG. 2a. In this case, the system indicates the presence of a hardfault even though the fault is essentially a very intermittent one. Theprior art fault monitoring system therefore suffers from thedisadvantage that it is not possible to distinguish properly betweenhard faults, hard recurrent faults and periodic intermittent faults.

[0023] In FIGS. 2b to 2 e, the integrator count is set for illustrativepurposes so that there is an upward count of 5 for every fault sampleand a downward count of 1 for every fault free sample. These figuresillustrate four different fault scenarios respectively. In FIG. 2b, asituation where a fault is permanent, i.e. ‘hard’, is indicated. In FIG.2c, a situation where the fault is periodically intermittent over thelong term is indicated but the character of the fault is such that thethreshold is not reached. In this case, the system does not indicate thepresence of a fault. FIGS. 2d and 2 e illustrate two differentintermittent fault scenarios which prior art systems cannot distinguishbetween. Both intermittent fault scenarios are such that the thresholdis reached and the system indicates the presence of a fault. However, inthe case of FIG. 2d, the nature of the fault is such that it isintermittent over the long term, resulting in a hard fault indication.In contrast, the nature of the fault giving rise to the count profileillustrated in FIG. 2e is such that it occurs persistently duringparticular engine operation phases only rather than consistently overthe long term. This scenario is indicated as an intermittent fault.

[0024] The flow chart of FIG. 3 illustrates an embodiment of theinvention in which the fault monitoring system is provided with meansfor measuring the trend of the integrator count towards and away fromthe threshold value. The fault monitoring system of FIG. 3 performssimilar steps to those described with reference to FIG. 1 except that insteps 11 and 12, an absolute fault and no fault count is initiated andincremented at steps 13 and 14 depending on whether or not a fault isdetermined at step 4. The ratio between the cumulative number of faultscounted at step 13 to the cumulative number of non-faults counted atstep 14 is calculated at step 15. It is therefore possible to record thetrend in the ratio of the fault periods against the number of fault-freeperiods. This data trend is capable of indicating a worsening faultsituation in which a hard fault would eventually be indicated by thesystem. The system may be operative for calculating the ratio of faultperiods against non-fault periods over an entire operating sequence, forexample an entire aircraft flight. In this case, the result wouldindicate the overall health of the parameter under review. A differenttype of indication such as a ratio of failures during a particularflight condition, such as take-off or descent may highlight transienteffects such as vibration or temperature changes, which are more likelyto be a factor influencing the generation of faults. The number ofsamples used to calculate the fault to non-fault ratio is a matter ofdesign choice depending on the diagnostic objective and computingperformance available.

[0025] An alternative embodiment is described with reference to FIG. 4,with similar steps to those of FIGS. 1 and 3 and bearing similarreference numerals. In this case, only the steps leading from decisionbox 4 are shown in FIG. 4 to highlight the differences between thismethod and that illustrated by FIG. 3. In this alternative embodiment,instead of determining the ratio or gradient between upward and downwardcounts, the system is operative for providing an indication of thedegree to which the integrator count value exceeds a lower integratorthreshold or sub-threshold W (see FIG. 5). In this embodiment, if nofault is sensed at decision box 4, it is determined at step 16 whetherthe integrator count is greater than the sub-threshold value W. If theresult in step 16 is affirmative, a record of the time that theintegrator count remains continuously above the threshold W is increasedat step 17. At step 18, a count representing the total time the count isabove threshold W is increased. In the event that the integrator countis determined at step 16 to have fallen below the sub-threshold W, thecount is reset to zero at step 19. The system then proceeds to check atstep 9 whether the integrator count can be decremented at step 10 aspreviously described with reference to FIG. 1.

[0026] In the event that a fault is confirmed at step 4, the systemdetermines at step 5 whether the integrator count is greater than orequal to the fault confirmation threshold Z as described hereinbeforewith reference to FIG. 1. If the integrator count is greater than orequal to the threshold Z then the system increments “the time above thesub-threshold W” and the “total time above the sub-threshold W” at steps23 and 24. If the integrator count is not greater than or equal to thethreshold Z at which a hard count is indicated, the integrator count isincremented at step 6 as hereinbefore described but there is asubsequent determination at step 20 as to whether the integrator countis greater than the sub-threshold W. If the count is greater, then thesystem increments the “time above the sub-threshold W” period and “totaltime above the sub-threshold W” as indicated at steps 21 and 22 in asimilar manner to that described hereinbefore in the case where no faultis detected in the system of FIG. 4.

[0027] As illustrated in FIG. 5, the system is capable of providing asignal indicative of the total time the sensor fault count exceeds thesub-threshold W and also the time of each period that the fault countexceeds the threshold. These values may be used to give an indication ofthe general trends in intermittent faults before they become registeredas hard faults on reaching the threshold Z. These data trends may beestablished by analysing the time periods calculated by the methodillustrated by FIG. 5, in different ways. For instance, the maximumcontinuous period above the sub-threshold W may be used, or the totaltime above this threshold. It is also possible to monitor the frequencyof periods above the sub-threshold. An advantage of the embodimentdescribed in FIG. 5 is that the system provides an output indicative ofthe state of the system being sensed, while reducing the requirement fortransferring an excessive quantity of data to be processed. The datatrends determined may be correlated against the total flight time of anaircraft or with individual flight phases such as take-off or landing orflight events such as deployment of undercarriage, or other maintenancemessages which may be received from health monitoring systems.

[0028]FIG. 6 illustrates schematically the components that make up thefault monitoring system for performing the functions described above. Atransducer 30 provides a signal 31 indicative of an input parameterbeing monitored to a fault detector 32. Fault detector 32 is operablefor sampling the signal 31 at predetermined time intervals and, for eachsample, determines whether the signal 31 is indicative of the existenceof a fault. For each sample, fault detector 32 provides a fault signal33, indicating either the existence or absence of a fault, to anintegrator 34. Integrator 34 counts the signal 33, according to themethod described above and provides a count signal 35, indicative of thecurrent value of the count, to a threshold detector 36. Thresholddetector 36 determines whether the current value of the count has areached a predetermined threshold, and, if it has, provides a signal toa hard fault indicator 38 to indicate the existence of a hard fault.

[0029] If the threshold detector 36 determines that the count has notreached the threshold, the count signal 35 is read by an integratorcount monitor 40. Integrator count monitor 40 determines, in accordancewith any of the methods described above, a fault status and provides asignal to a fault status indicator 42 for indicating the current statusof the fault.

[0030] It will be appreciated that components of the system described inFIG. 6 may be implemented in hardware or within a computer ormicroprocessor in software.

1. A fault monitoring system comprising: a fault detection mechanism forproviding a fault status indication of a parameter to be monitored; anintegrator for incrementing a count in one direction by a predeterminedfault increment when the fault detection mechanism provides a faultindication, and for incrementing said integrator count in an oppositedirection by a predetermined no-fault increment in the absence of faultdetection; a threshold detector for generating a hard fault indicationwhen the integrator count reaches a threshold value; an integrator countmonitor for generating information indicative of the state of theintegrator count when below the threshold value thereby to provide anindication of the progression of the fault.
 2. The system of claim 1 ,further comprising a correlator for correlating said informationgenerated by the integrator count monitor with system operatingparameters so as to provide a fault status or a diagnostic in responseto the correlation.
 3. The system of claim 2 wherein the predeterminedfault increment is greater than or equal to the predetermined no-faultincrement.
 4. The system of claim 2 wherein the integrator count monitoris operative to generate a further indication dependent on theintegrator count relative to a sub-threshold value which is set belowthe threshold value.
 5. The system of claim 4 wherein said informationindicative of the state of the integrator count is the frequency withwhich the integrator count exceeds the sub-threshold value;
 6. Thesystem of claim 4 wherein said information indicative of the state ofthe integrator count is the total time said sub-threshold value isexceeded.
 7. The system of claim 4 wherein said information indicativeof the state of the integrator count is the maximum continuous periodthe integrator count exceeds said sub-threshold value.
 8. The system ofclaim 2 wherein the correlating means is operative for correlating saidinformation indicative of the state of the integrator with operatingphases of the system and for generating appropriate system healthmessages.
 9. The system of claim 1 wherein the integrator count monitoris operative to generate an indication of the ratio between the count inthe one direction and the count in the opposite direction for providinginformation as to the direction of the progression of the sensed faultrelative to a hard fault condition.
 10. The system of claim 9 whereinthe predetermined fault increment is greater than or equal to thepredetermined no-fault increment.
 11. The system of claim 9 furthercomprising a correlator for correlating said information generated bythe integrator count monitor with system operating parameters so as toprovide a fault status or a diagnostic in response to the correlation.12. The system of claim 11 wherein the correlator is operative forcorrelating said information indicative of the state of the integratorwith operating phases of the system and for generating appropriatesystem health messages.
 13. The system of claim 9 wherein the ratio isan averaged ratio over a predetermined period of time.
 14. The system ofclaim 9 wherein the ratio is an averaged ratio for the duration of aspecified system operating condition.
 15. A method of providing anindication of the progression of a fault, the method comprising:monitoring a parameter to detect the fault; incrementing an integratorcount in one direction when the fault is detected; incrementing theintegrator count in an opposite direction in the absence of faultdetection; generating a hard fault indication when the integrator countreaches a threshold value; and generating information indicative of thestate of the integrator count when below the threshold value.
 16. Themethod of claim 15 further comprising correlating said informationindicative of the state of the integrator count with system operatingparameters; and providing a fault status or diagnostic in response tothe correlation.
 17. The method of claim 15 wherein generatinginformation indicative of the state of the integrator count includesgenerating an indication of the ratio between the count in the onedirection and the count in the opposite direction thereby providinginformation as to the direction of the progression of the sensed faultrelative to a hard fault condition.
 18. The method of claim 17 whereingenerating an indication of the ratio between the count in the onedirection and the count in the opposite direction includes averaging theratio over a predetermined period of time.
 19. The method of claim 17wherein generating an indication of the ratio between the count in theone direction and the count in the opposite direction includes averagingthe ratio for the duration of a specified system operating condition.20. The method of claim 16 wherein generating information indicative ofthe state of the integrator count includes generating an indicationdependent on the integrator count relative to a sub-threshold valuewhich is set below the threshold value.